feat: paginate provider keys from backend

apps/aether-gateway/src/tests/control/admin/endpoints/keys.rs

@@ -118,6 +118,90 @@ async fn gateway_handles_admin_provider_keys_locally_with_trusted_admin_principa
     upstream_handle.abort();
 }
 
+#[tokio::test]
+async fn gateway_handles_admin_provider_keys_page_locally_with_total() {
+    let upstream_hits = Arc::new(Mutex::new(0usize));
+    let upstream_hits_clone = Arc::clone(&upstream_hits);
+    let upstream = Router::new().route(
+        "/api/admin/endpoints/providers/provider-openai/keys",
+        any(move |_request: Request| {
+            let upstream_hits_inner = Arc::clone(&upstream_hits_clone);
+            async move {
+                *upstream_hits_inner.lock().expect("mutex should lock") += 1;
+                (StatusCode::OK, Body::from("unexpected upstream hit"))
+            }
+        }),
+    );
+
+    let mut key_a = sample_key(
+        "key-openai-a",
+        "provider-openai",
+        "openai:chat",
+        "sk-test-a",
+    );
+    key_a.internal_priority = 10;
+    key_a.created_at_unix_ms = Some(1_711_000_000);
+
+    let mut key_b = sample_key(
+        "key-openai-b",
+        "provider-openai",
+        "openai:chat",
+        "sk-test-b",
+    );
+    key_b.internal_priority = 20;
+    key_b.created_at_unix_ms = Some(1_711_100_000);
+
+    let mut key_c = sample_key(
+        "key-openai-c",
+        "provider-openai",
+        "openai:chat",
+        "sk-test-c",
+    );
+    key_c.internal_priority = 30;
+    key_c.created_at_unix_ms = Some(1_711_200_000);
+
+    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
+        vec![sample_provider("provider-openai", "openai", 10)],
+        vec![],
+        vec![key_a, key_b, key_c],
+    ));
+
+    let (_upstream_url, upstream_handle) = start_server(upstream).await;
+    let gateway = build_router_with_state(
+        AppState::new()
+            .expect("gateway should build")
+            .with_data_state_for_tests(GatewayDataState::with_provider_catalog_reader_for_tests(
+                provider_catalog_repository,
+            )),
+    );
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+
+    let response = reqwest::Client::new()
+        .get(format!(
+            "{gateway_url}/api/admin/endpoints/providers/provider-openai/keys?page=2&page_size=1"
+        ))
+        .header(crate::constants::GATEWAY_HEADER, "rust-phase3b")
+        .header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
+        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
+        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let payload: serde_json::Value = response.json().await.expect("json body should parse");
+    assert_eq!(payload["total"], 3);
+    assert_eq!(payload["page"], 2);
+    assert_eq!(payload["page_size"], 1);
+    let items = payload["keys"].as_array().expect("keys should be an array");
+    assert_eq!(items.len(), 1);
+    assert_eq!(items[0]["id"], "key-openai-b");
+    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);
+
+    gateway_handle.abort();
+    upstream_handle.abort();
+}
+
 #[tokio::test]
 async fn gateway_admin_provider_keys_prefers_upstream_plan_type_over_auth_config() {
     let upstream_hits = Arc::new(Mutex::new(0usize));